Dashboards & Visualizations

How to append in stringreplace Advanced XML

mjohanne
Explorer

Hello,

I am trying to modify a custom UI that uses a HiddenSearch and fields to fill its values. For one of the fields if a user enters a value ("123" for example) we need to create the search token to look like "source=*\\ID_123\\*". If the field is left blank than nothing is added.

Using the prefix option in stringreplace I am able to get part of what is needed (source=*\\ID_123), but can not find a way to get the "\\*" appended.

See code snippets below. Any suggestions on how this can be done?

Thanks in advance.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <param name="search">index=aqua $instanceToken$ $reverseToken$</param>

<module name="ExtendedFieldSearch">
  <param name="field">Instance</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="instanceToken">
        <param name="fillOnEmpty">false</param>
        <param name="prefix">source=*\\</param>
      </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="instanceToken">
        <param name="value">$instanceToken$</param>
      </param>
    </param>
  </param>
1 Solution

Johnvey
Contributor

Add a matching suffix parameter to your config:

    <param name="fillOnEmpty">false</param>
    <param name="prefix">source=*\\</param>
    <param name="suffix">\\*</param>

As you've already done, the fillOnEmpty flag will prevent anything from being injected if the user has not entered anything into the text box.

View solution in original post

Johnvey
Contributor

Add a matching suffix parameter to your config:

    <param name="fillOnEmpty">false</param>
    <param name="prefix">source=*\\</param>
    <param name="suffix">\\*</param>

As you've already done, the fillOnEmpty flag will prevent anything from being injected if the user has not entered anything into the text box.

mjohanne
Explorer

Thanks, that got it working.

0 Karma

sideview
SplunkTrust
SplunkTrust

If you install the Sideview Utils app, this becomes a lot easier with its TextField module. There's probably a way to do a suffix in ExtendedFieldSearch but it's not in the replacement map, and I dont think you can just put a 'suffix' into the stringreplace intention, and that would leave hardwiring it in the HiddenSearch which isnt a very good idea.

Here's the equivalent config in Sideview Utils. It's a bit easier as you see. Note that either way you almost certainly will need to backslash-escape those backslashes.

<module name="TextField">
  <param name="name">source</param>
  <param name="template">$name$="*\\\\$value$\\\\*"</param>
  <param name="label">Source:</param>
  ....

With the TextField module, you can just refer to this token (in all it's source="*\\*" glory), within Sideview's Search module, just by $source$. You wont need any intentions if you use both the TextField module instead of ExtendedFieldSearch, and the Search module instead of HiddenSearch.

You also may want to debug the token so that you can check that the backslash escaping is working. You can do that just by putting an HTML module inside the TextField, like so:

<module name="TextField">
  <param name="name">source</param>
  <param name="template">$name$="*\\\\$value$\\\\*"</param>
  <param name="label">Source:</param>
  <module name="HTML">
    <param name="html"><![CDATA[
      Debugging: <br>
      (use this when you're doing search language in Search or PostProcess)<br>
      source = $source$ <br>
      <br>
      (use this when you're making headers for the user)<br>
      source.rawValue = $source.rawValue$  <br>

    ]]></param>
  </module>
  ....

mjohanne
Explorer

Thanks for the info, I will look at Sideview for use in the future.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...